Executive brief
Label Studio is a web-based data annotation platform used by teams to label and categorize training data for machine learning. The application fails to properly validate webhook destination URLs, allowing authenticated users to send data to internal networks and cloud metadata services. An attacker with platform access could exfiltrate sensitive annotation data and potentially access cloud credentials or private infrastructure.
Technical details
Label Studio through version 1.23.0 lacks proper URL validation in the webhook functionality (label_studio/webhooks/utils.py), allowing authenticated users to create webhooks targeting RFC 1918 private IP ranges and cloud metadata endpoints. The vulnerability enables Server-Side Request Forgery (SSRF) attacks where authenticated users craft webhook configurations to dispatch requests to internal services. An attacker with valid platform credentials can exfiltrate annotation data through webhook payloads sent to attacker-controlled or metadata endpoints. Authentication is required, but the attack occurs post-authentication. Patches should implement URL allowlisting, private IP range blocking, and metadata endpoint restrictions.
Affected products
- HumanSignal Label Studio through 1.23.0
Timeline
- 2026-09-03: disclosed